paramant-relay
Post-quantum encrypted file relay using ML-KEM-768 and AES-256-GCM, burn-on-read architecture with EU jurisdiction compliance.
Ficha actualizada 22 sept 2026, 21:22 · upstream 22 sept 2026, 21:13 · release v3.0.0
Qué es paramant-relay
Descripción editorial construida a partir del repositorio, su documentación y sus señales de mantenimiento.
Paramant Relay is a post-quantum secure file transfer service that encrypts data client-side using ML-KEM-768 combined with AES-256-GCM. The relay operates on RAM only, performing burn-on-read semantics where ciphertext is hashed into a Merkle tree and signed by the relay before being delivered to recipients. Every transfer is recorded in a public Merkle tree proving delivery without storing plaintext content. The service supports anonymous drop (no account required), user accounts with TOTP authentication, and full audit logging. It is designed for compliance with EU/NIS2 regulations and NEN7510 standards.
- Secure file transfer between organizations requiring post-quantum security guarantees
- Compliance-driven document exchange in regulated industries (finance, healthcare)
- Anonymous data sharing where recipient identity must remain confidential
- Enterprise environments needing audit trails and non-repudiation of transfers
- Self-hosted secure communication for sensitive internal operations
- Cross-border data transfer with EU jurisdictional compliance
- ML-KEM-768 post-quantum key exchange provides forward secrecy against quantum attacks
- AES-256-GCM encryption ensures authenticated, integrity-protected data in transit
- Burn-on-read architecture means ciphertext is destroyed after delivery with no disk persistence
- Merkle tree-based Merkle proof allows public verification of file delivery without revealing content
- Zero-knowledge design: relay never stores plaintext or recipient identity information
- EU/NIS2 compliant deployment with full audit logging and tamper detection
- Relay only handles fixed-size (5 MB) ciphertext blobs; larger files require multiple transfers
- No support for encrypted file sizes exceeding the relay's memory capacity
- Anonymous drop mode requires manual mnemonic key generation with no recovery mechanism
- TLS/SSL termination is not supported by default, requiring client-side encryption setup
- Relay does not provide end-to-end encryption for client-to-relay communication
Perfil de infraestructura
Estimación inicial derivada del repositorio y de los servicios detectados.
Despliegue detectado
Qué señales reales de instalación hemos encontrado.
Deploy via Docker Compose with 5 relay containers and 1 admin panel container. Configure environment variables including ADMIN_TOKEN (generated with openssl). Start with docker compose up -d to launch all services. For self-hosted Raspberry Pi deployment, run the install-pi.sh script from paramant.app. The relay exposes port 3001 for health checks and API endpoints on ports 3000-4200. Enable static frontend serving with SERVE_FRONTEND=1 for plug-and-play self-hosting without a separate web server.
Stack y dependencias
Componentes inferidos a partir de manifests, configuración y documentación.
Puede sustituir a
Relaciones detectadas por el análisis del repositorio y su categoría.
Experiencia real de la comunidad
Ayuda a contrastar la estimación automática con instalaciones reales.
Todavía no hay datos comunitarios para este proyecto.